CVE-2026-110457 in UniFi Protect AI Key
Summary
by MITRE • 10/14/2026
A malicious actor with access to the network and under certain conditions could exploit a Path Traversal vulnerability found in UniFi Protect AI Key to obtain information about files on the device.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/14/2026
The identified security flaw represents a critical path traversal vulnerability within the UniFi Protect AI Key, an edge computing appliance designed for video analytics and processing. This type of vulnerability typically arises when an application constructs file paths from user-supplied input without adequately sanitizing or validating that input to ensure it remains within the intended directory structure. In this specific context, the flaw allows a malicious actor who has gained access to the network segment where the AI Key resides to manipulate request parameters in a way that bypasses standard security controls. By utilizing sequences such as dot-dot-slash (../) or other platform-specific path traversal techniques, an attacker can redirect file read operations away from the designated application directories and into sensitive areas of the operating system's filesystem. This lack of strict input validation on endpoints handling configuration files, logs, or internal data structures creates a direct pathway for unauthorized information disclosure.
The operational impact of this vulnerability is significant due to the nature of the device itself. The UniFi Protect AI Key processes high-value surveillance footage and manages access control logic for security systems. Successful exploitation could allow an attacker to read sensitive configuration files that may contain API keys, database credentials, network topology details, or encryption keys used by the system. Furthermore, accessing log files might reveal historical data about user activities, IP addresses of connected devices, and other metadata that aids in further reconnaissance. While the primary impact described is information disclosure, access to these internal files could potentially serve as a stepping stone for more severe attacks, such as privilege escalation or remote code execution if combined with other vulnerabilities. The risk is exacerbated by the fact that network-level access often implies proximity to critical infrastructure components, making this vulnerability particularly dangerous in enterprise environments where lateral movement can lead to broader system compromise.
From a classification perspective, this issue aligns directly with CWE-22: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal). This weakness category encompasses flaws where software does not properly neutralize special elements within file paths that could resolve to files or directories outside of the intended restricted directory. Additionally, in terms of offensive security tactics, this vulnerability facilitates techniques associated with ATT&CK ID T1083: File and Directory Discovery. Attackers leverage such weaknesses to map out the target system's structure, identifying valuable targets for subsequent exploitation phases. The ability to traverse paths effectively undermines the principle of least privilege by granting access to resources that should be isolated from user-level or network-accessible processes.
Mitigation strategies must address both immediate remediation and long-term architectural resilience. The primary defense is the implementation of strict input validation on all endpoints within the AI Key software stack, ensuring that any file path constructed from external inputs is canonicalized and verified against a whitelist of allowed directories. Developers should utilize operating system APIs that abstract away raw string manipulation for paths, such as using secure library functions that inherently prevent traversal sequences. Furthermore, deploying network segmentation policies to restrict access to the management interfaces of security appliances can limit the attack surface available to potential adversaries. Regular patching is essential; users must apply vendor-provided updates that address this specific path handling logic flaw. Security monitoring should also be enhanced to detect anomalous file access patterns or unusual HTTP requests containing traversal characters, providing an additional layer of defense through intrusion detection systems configured to recognize these specific exploitation signatures.